Security Bulletin: IBM Maximo Application Suite - Monitor Component is vulnerable to Log Forging CVE-2024-35150

Summary IBM Maximo Application Suite - Monitor Component is vulnerable to Log Forging CVE-2024-35150. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2024-35150 DESCRIPTION: IBM Maximo Application Suite - Monitor Component does not...

DEBIAN-CVE-2024-1681

corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files,...

CVE-2023-46713

Fortinet FortiWeb is affected by CVE-2023-46713 due to improper output neutralization for logs, enabling forging of traffic logs via a crafted URL. Affected versions: 6.2.0–6.2.8, 6.3.0–6.3.23, 7.0.0–7.0.9, 7.2.0–7.2.5, and 7.4.0. Remediation per vendor sources: upgrade to a version outside these...

CVE-2022-32549

A flaw was found in Apache Sling Commons Log. This flaw allows an attacker to benefit from the flaw and forge logs, allowing cover tracks and potentially corrupting log files...

CVE-2022-32549

Apache Sling Commons Log = 5.4.0 and Apache Sling API = 2.25.0 are vulnerable to log injection. The ability to forge logs may allow an attacker to cover tracks by injecting fake logs and potentially corrupt log files...

PYSEC-2021-435

Improper output neutralization for Logs. A specific Apache Superset HTTP endpoint allowed for an authenticated user to forge log entries or inject malicious content into logs...

PT-2021-23566 · Apache · Apache Superset

Name of the Vulnerable Software and Affected Versions: Apache Superset affected versions not specified Description: The issue concerns improper output neutralization for logs, allowing an authenticated user to forge log entries or inject malicious content into logs through a specific Apache...

Apache Superset 安全漏洞

A code injection vulnerability exists in Apache Superset, a data visualization and data exploration platform from the Apache Foundation, prior to version 1.3.2, which stems from a web-based system or product that does not properly authenticate incoming data. An authenticated attacker could exploi...

CVE-2020-4072 Log Forging in generator-jhipster-kotlin

In generator-jhipster-kotlin version 1.6.0 log entries are created for invalid password reset attempts. As the email is provided by a user and the api is public this can be used by an attacker to forge log entries. This is vulnerable to https://cwe.mitre.org/data/definitions/117.html This problem...

GHSA-PFXF-WH96-FVJC Log Forging in generator-jhipster-kotlin

Impact We log the mail for invalid password reset attempts. As the email is provided by a user and the api is public this can be used by an attacker to forge log entries. This is vulnerable to https://cwe.mitre.org/data/definitions/117.html This problem affects only application generated with jwt...

Log Forging in generator-jhipster-kotlin

Impact We log the mail for invalid password reset attempts. As the email is provided by a user and the api is public this can be used by an attacker to forge log entries. This is vulnerable to https://cwe.mitre.org/data/definitions/117.html This problem affects only application generated with jwt...

Log forging vulnerability

It is possible to fake log entries in FishEye/Crucible logs, by sending specially crafted http requests containing a newline character. For example going to the url /changelog/asd%0AFake%20log%20entry will cause the following to be logged: code 2015-03-24 09:59:09,564 INFO qtp1610928748-315 fishe...

Log forging vulnerability

It is possible to fake log entries in FishEye/Crucible logs, by sending specially crafted http requests containing a newline character. For example going to the url /changelog/asd%0AFake%20log%20entry will cause the following to be logged: code 2015-03-24 09:59:09,564 INFO qtp1610928748-315 fishe...

Log forging vulnerability

It is possible to fake log entries in FishEye/Crucible logs, by sending specially crafted http requests containing a newline character. For example going to the url /changelog/asd%0AFake%20log%20entry will cause the following to be logged: code 2015-03-24 09:59:09,564 INFO qtp1610928748-315 fishe...

Log forging vulnerability

It is possible to fake log entries in FishEye/Crucible logs, by sending specially crafted http requests containing a newline character. For example going to the url /changelog/asd%0AFake%20log%20entry will cause the following to be logged: code 2015-03-24 09:59:09,564 INFO qtp1610928748-315 fishe...

CFME: AgentController get/log application log forging

It was found that the get and log methods of the AgentController wrote log messages without sanitizing user input. A remote attacker could use this flaw to insert arbitrary content into the log files written to by AgentController...

openSUSE Security Update : icecast (openSUSE-SU-2012:0352-1)

Icecast didn't strip newlines from log entries, therefore allowing uses to forge log entries. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2012-153. The text description of this...

Greenstone XSS / Password Disclosure / Log Forging

Greenstone Digital Library Software suffers from cross site scripting, password file disclosure, broken salt, and log forging vulnerabilities. ======================================================================== Vulnerable Software: Greenstone Digital Library Software. Official Site:...

Greenstone XSS / Password Disclosure / Log Forging

======================================================================== Vulnerable Software: Greenstone Digital Library Software. Official Site: http://www.greenstone.org/ Dork: inurl:gsdl/etc/ ========================================================================== About software: The aim of...

SuSE 10 Security Update : PostgreSQL (ZYPP Patch Number 7404)

A buffer overflow in the intarray module potentially allowed attackers to execute arbitrary code as the user running postgresql. CVE-2010-4015:CVSS v2 Base Score: 4.9 Additionally a possible log forging problem was fixed too. CVE-2010-4014 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...